2.4、Ingress入口配置

# Ingress公网暴露配置

## 📖 说明

本文档提供Kubernetes Ingress公网暴露的完整配置方案。

## 🎯 方案对比

| 方案 | 复杂度 | 可靠性 | 成本 | 适用场景 |
|------|-------|--------|-----|---------|
| **方案A：云厂商LoadBalancer** | ⭐ | ⭐⭐⭐⭐⭐ | 高 | 推荐，生产环境 |
| **方案B：HostNetwork模式** | ⭐⭐ | ⭐⭐⭐⭐ | 低 | 自建集群 |
| **方案C：NodePort + 云LB** | ⭐⭐ | ⭐⭐⭐⭐ | 中 | 手动配置 |

## 📄 完整配置

```yaml
# ========================================
# 正确的公网暴露方案（不用MetalLB）
# ========================================

# 方案A：直接使用云厂商LoadBalancer（推荐）
---
apiVersion: v1
kind: Service
metadata:
  name: nginx-ingress-prod
  namespace: ingress-nginx
  annotations:
    # 腾讯云示例
    service.kubernetes.io/qcloud-loadbalancer-internal-subnetid: "subnet-xxx"
    service.kubernetes.io/qcloud-loadbalancer-internet-charge-type: "TRAFFIC_POSTPAID_BY_HOUR"
    service.kubernetes.io/qcloud-loadbalancer-eip-id: "eip-xxx"  # 绑定指定EIP
    # 或阿里云
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-address-type: "internet"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-id: "lb-xxx"
spec:
  type: LoadBalancer
  externalIPs:
  - 172.93.107.95  # 生产IP
  - 172.93.107.96  # 备用IP
  selector:
    app.kubernetes.io/name: ingress-nginx
  ports:
  - name: http
    port: 80
    targetPort: http
  - name: https
    port: 443
    targetPort: https
  externalTrafficPolicy: Local  # 保留源IP

---
# 方案B：HostNetwork + 云厂商弹性网卡
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: nginx-ingress-prod
  namespace: ingress-nginx
spec:
  selector:
    matchLabels:
      app: nginx-ingress-prod
  template:
    metadata:
      labels:
        app: nginx-ingress-prod
    spec:
      hostNetwork: true  # 使用宿主机网络
      dnsPolicy: ClusterFirstWithHostNet
      nodeSelector:
        env: prod
        topology.kubernetes.io/zone: cloud-a
      containers:
      - name: nginx-ingress
        image: registry.k8s.io/ingress-nginx/controller:v1.9.4
        args:
        - /nginx-ingress-controller
        - --publish-service=$(POD_NAMESPACE)/nginx-ingress-prod
        ports:
        - name: http
          containerPort: 80
          hostPort: 80
        - name: https
          containerPort: 443
          hostPort: 443

# 云厂商配置：
# 1. 创建弹性网卡，绑定公网IP 172.93.107.95
# 2. 将网卡附加到Worker节点
# 3. 云安全组开放80/443端口

---
# 方案C：NodePort + 云LB手动配置
---
apiVersion: v1
kind: Service
metadata:
  name: nginx-ingress-prod
  namespace: ingress-nginx
spec:
  type: NodePort
  selector:
    app.kubernetes.io/name: ingress-nginx
  ports:
  - name: http
    port: 80
    targetPort: 80
    nodePort: 30080
  - name: https
    port: 443
    targetPort: 443
    nodePort: 30443

# 云厂商LB配置：
# 监听器1: 172.93.107.95:443 -> 云A所有Worker节点:30443
# 监听器2: 172.93.107.95:80  -> 云A所有Worker节点:30080
# 健康检查: TCP 30443

---
# ========================================
# 如果坚持用MetalLB，必须用BGP模式
# ========================================
# 前提：云厂商支持BGP对等（需开通专线/VPC对等）

apiVersion: metallb.io/v1beta1
kind: BGPPeer
metadata:
  name: cloud-a-peer
  namespace: metallb-system
spec:
  myASN: 64512
  peerASN: 65000  # 云厂商BGP ASN
  peerAddress: 10.25.72.254  # 云厂商BGP路由器
---
apiVersion: metallb.io/v1beta1
kind: BGPAdvertisement
metadata:
  name: prod-bgp-advert
  namespace: metallb-system
spec:
  ipAddressPools:
  - prod-pool-cloud-a
  peers:
  - cloud-a-peer
  localPref: 100

# 注意：大部分云厂商不支持在计算实例上跑BGP
# 需要购买专线服务才能使用
```

## 🔧 部署步骤

### 方案A：云厂商LoadBalancer

```bash
# 1. 安装Nginx Ingress Controller
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.9.4/deploy/static/provider/cloud/deploy.yaml

# 2. 配置Service注解（根据云厂商修改）
kubectl annotate svc ingress-nginx-controller -n ingress-nginx \
  service.kubernetes.io/qcloud-loadbalancer-internet-charge-type="TRAFFIC_POSTPAID_BY_HOUR"

# 3. 查看外部IP
kubectl get svc -n ingress-nginx
```

### 方案B：HostNetwork模式

```bash
# 1. 部署DaemonSet
kubectl apply -f 2.4、Ingress入口配置.md

# 2. 在云厂商控制台绑定弹性网卡

# 3. 验证
curl -k https://<公网IP>
```

## ⚠️ 注意事项

- **MetalLB不适用**：大部分云环境不支持Layer2/BGP
- **云LB推荐**：最稳定可靠的方案
- **HostNetwork**：需要手动管理公网IP绑定
- **安全组**：记得开放80/443端口

## 📁 原始文件

原始YAML配置文件位于：`solutions/ingress-expose-fix.yaml`

## 🔗 相关文档

- 域名规划：[1.3、域名规划.md](./1.3、域名规划.md)
- 网络规划：[1.2、IP分配规划.md](./1.2、IP分配规划.md)

---

**更新时间：** 2025-01-22